creates Users, and sets up session authentication